Rule 7 breach report template

About this document

This is a working template that mirrors the contents listed in Rule 7 of the Digital Personal Data Protection Rules, 2025. It is not an official Board form.

Check the current Rules and any Board directions before you file.

Part A. Intimation to the Board (without delay)

Data Fiduciary (legal name):

Contact for this incident (name, email, phone):

Date and time you became aware of the breach:

Date and time of this intimation:

Short description of the breach:

Part B. Intimation to each affected Data Principal (without delay)

Send in plain language through the person's user account or registered contact.

What happened: the nature, extent and timing of the breach:

Likely consequences for you:

What we have done and are doing to reduce the risk:

Steps you can take to protect yourself:

Who to contact (name or role, email, phone):

Part C. Detailed report to the Board (within 72 hours of becoming aware)

Facts and circumstances of the breach:

Events leading to the breach and its cause:

Measures taken or proposed to mitigate the risk:

Findings on the person who caused the breach, if known:

Remedial steps taken to prevent a recurrence:

Report on the intimations given to affected Data Principals:

Date this report is submitted:

If submitted after 72 hours, reference of the Board's permission on your written request:

Part D. Evidence appendix (internal)

Incident reference (sample format: INC-2041):

Systems and data stores affected:

Number of affected Data Principals (estimate):

Types of personal data involved:

Timeline of events, with times:

Logs retained and where they are kept:

Decisions and approvals, with names and times: